DPDP Rules 2025 Compliance Checklist for Websites and Apps: What to Fix Before 13 May 2027
Updated: October 2026
India's Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 13 November 2025. Most of the obligations that affect everyday businesses, such as privacy notices, consent, security safeguards, breach reporting and user rights, apply from 13 May 2027.
That sounds far away, but every contact form, sign-up page, checkout, chatbot, WhatsApp flow, CRM and marketing pixel on your website or app collects personal data. Fixing all of them takes months, not days.
Most DPDP articles are written by lawyers for lawyers. This one is written for the people who actually have to change the website: business owners, product managers, developers and marketers. It gives you a practical, screen-by-screen checklist, a month-by-month roadmap from now until the deadline, and sample consent wording you can adapt.
Contents
- DPDP timeline: the 3 dates that matter
- Does DPDP apply to your business?
- The 14-point DPDP checklist for websites and apps
- Sample consent wording for a contact form
- Month-by-month roadmap to 13 May 2027
- Penalties under the DPDP Act
- DPDP vs GDPR: quick comparison
- Common mistakes to avoid
- Frequently asked questions
DPDP timeline: the 3 dates that matter
| Date | What starts | What it means for you |
|---|---|---|
| 13 November 2025 | Rules notified; provisions setting up the Data Protection Board of India apply | The regulator is being set up. Start planning. |
| 13 November 2026 | Consent Manager registration rules apply | Registered Consent Managers can start operating. Decide whether you will use one. |
| 13 May 2027 | Core obligations apply: notice, consent, security safeguards, breach intimation, user rights, retention and erasure, children's data, Significant Data Fiduciary duties | Your website, app and internal processes must be compliant. |
There is no sign of an extra grace period beyond these dates, so treat 13 May 2027 as a hard deadline.
Does DPDP apply to your business?
In short, if you collect or use personal data of people in India in digital form, it almost certainly applies to you. That includes data collected offline and later typed into a computer or spreadsheet. It also applies to businesses outside India that offer goods or services to people in India.
Four terms you will see everywhere:
- Data Principal: the person the data is about (your customer, lead, patient, student or employee). For a child, this includes the parent or lawful guardian.
- Data Fiduciary: your business, if you decide why and how the data is used.
- Data Processor: a vendor that processes data for you, such as your hosting company, CRM, email tool or WhatsApp provider.
- Consent Manager: a platform registered with the Data Protection Board that lets people give, manage and withdraw consent across businesses.
Some large or sensitive businesses may be notified as Significant Data Fiduciaries. They have extra duties, including appointing a Data Protection Officer based in India, independent data audits and regular impact assessments.
There is no blanket exemption for small businesses. The Act allows the government to exempt certain classes of businesses, including startups, from some provisions, but the safest plan is to assume the rules apply to you.
The 14-point DPDP checklist for websites and apps
Use this as your working checklist. Each row says what to change and who usually owns it.
| # | Area | What to do on your website or app | Owner |
|---|---|---|---|
| 1 | Data map | List every place you collect personal data: contact and enquiry forms, sign-up, checkout, live chat, chatbots, WhatsApp, call recordings, cookies and pixels, CRM, email tools and spreadsheets. | Ops + Dev |
| 2 | Privacy notice | Publish a standalone notice in clear, plain language that itemises the data you collect, the purpose, the service it enables, how to withdraw consent and how to complain to the Data Protection Board. Offer it in English or an Indian language listed in the Constitution's Eighth Schedule. | Legal + Dev |
| 3 | Consent capture | Use unticked checkboxes. Ask for separate consent for each purpose, especially marketing. Store a consent record: who, when, what notice version and for which purpose. | Dev |
| 4 | Easy withdrawal | Withdrawing consent must be as easy as giving it: a visible "Withdraw consent" or "Unsubscribe" option on the site, in emails and in the app settings. | Dev |
| 5 | Marketing tags | If analytics or ad pixels collect personal data for marketing, load them only after the user agrees. Audit every third-party script on the site. | Dev + Marketing |
| 6 | Children's data | If under-18 users may sign up, add an age check and collect verifiable parental consent. Do not track, behaviourally monitor or target ads at children. | Product |
| 7 | User rights | Add a "Your data" request form for access, correction, erasure, nomination and grievances. Track every request as a ticket and reply within the time limit (grievances: within 90 days at most). | Ops |
| 8 | Contact person | Publish the contact details of your Data Protection Officer, or a person who can answer data questions, prominently on the website and app. | Legal |
| 9 | Security safeguards | Use encryption, masking or tokenisation for personal data, role-based access, MFA for admin panels, logging and monitoring, and backups. Keep logs and related personal data for at least one year to detect and investigate misuse. | Dev + IT |
| 10 | Vendor contracts | Sign data processing terms with hosting, CRM, email, SMS, WhatsApp, analytics and payment vendors covering security, confidentiality and deletion. | Legal |
| 11 | Breach response | Write an incident plan. If a breach happens, inform affected users and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. Run a practice drill. | IT + Leadership |
| 12 | Retention and deletion | Delete data once its purpose is served, using automatic deletion jobs where possible. Very large e-commerce, gaming and social media platforms must erase data of users inactive for three years, with at least 48 hours' notice before erasure. | Dev |
| 13 | Existing customer data | For people who gave consent before the law took effect, send them a DPDP-compliant notice as soon as reasonably practicable. | Marketing + Ops |
| 14 | Staff training | Train sales, support and marketing teams on consent, data requests and what to do if they suspect a breach. | HR |
Where DPDP touches a typical website
- Contact and quote forms: notice link, purpose-specific consent, separate marketing opt-in.
- Newsletter and WhatsApp opt-ins: clear opt-in and one-tap opt-out.
- Checkout and accounts: data minimisation (ask only what you need), account deletion option.
- Chatbots and AI assistants: tell users what is stored, avoid collecting sensitive data you do not need, and set retention limits on chat logs.
- Careers page: candidate data has its own purpose and retention period.
- Admin panel and database: access control, MFA, encryption, logging.
Sample consent wording for a contact form
Adapt this example to your own business and have it reviewed by your legal advisor:
☐ I agree that [Company Name] may use my name, phone number and email address to respond to this enquiry and send the quote I requested. My data is kept for [period] and is never sold. I can withdraw consent at any time at [link] or by emailing [email]. Read the full privacy notice. I can also raise a complaint with the Data Protection Board of India.
☐ (Optional) Send me offers and updates on WhatsApp and email.
Notice what makes this work: both boxes start unticked, the marketing consent is separate and optional, the purpose is specific, and withdrawal is explained right next to the checkbox.
Month-by-month roadmap to 13 May 2027
| When | Focus | Key outputs |
|---|---|---|
| Oct – Nov 2026 | Discover | Data map of all forms, tools and vendors; gap analysis against the 14-point checklist; decide on a Consent Manager (registration opens 13 Nov 2026). |
| Dec 2026 – Jan 2027 | Notices and consent | New privacy notice; rebuilt consent checkboxes and records; marketing tags loading only after consent. |
| Feb 2027 | Rights and retention | "Your data" request form and ticket workflow; retention schedule; automatic deletion jobs; vendor contracts signed. |
| Mar 2027 | Security | Encryption, access control, MFA, logging with one-year retention, backups; security audit (VAPT) and fixes. |
| Apr 2027 | Readiness | Breach response plan and drill; staff training; notices sent to existing customers; final legal review. |
| 13 May 2027 | Go live | Obligations apply. Keep monitoring, logging and answering requests. |
Penalties under the DPDP Act
Penalties are decided by the Data Protection Board and can reach:
- Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach
- Up to ₹200 crore for failing to notify the Board and affected people about a breach
- Up to ₹200 crore for breaking the rules on children's data
- Up to ₹150 crore for Significant Data Fiduciaries that miss their extra obligations
- Up to ₹50 crore for other breaches of the Act or Rules
Beyond fines, a public data breach can cost you customer trust, which is much harder to win back.
DPDP vs GDPR: quick comparison
Many Indian websites copied a European GDPR privacy policy years ago. That is not enough. Key differences:
| India's DPDP | EU's GDPR | |
|---|---|---|
| Grounds for processing | Consent, plus a short list of "legitimate uses" | Six legal bases, including "legitimate interests" |
| Breach reporting | Tell affected people and the Board without delay; detailed report to the Board within 72 hours | Report to the authority within 72 hours; tell people if the risk is high |
| Children | Under 18 needs verifiable parental consent; no tracking or targeted ads | Age limit set by each country, between 13 and 16 |
| Maximum fine | Up to ₹250 crore per instance | Up to €20 million or 4% of global annual turnover, whichever is higher |
Common mistakes to avoid
- Pre-ticked consent boxes or one checkbox that covers everything
- Hiding the unsubscribe or withdrawal option
- Forgetting data outside the website: WhatsApp chats, Excel sheets, call recordings and email inboxes
- Loading marketing pixels before the user agrees
- No written breach plan, so nobody knows who to call when something goes wrong
- Ignoring vendors: your business is still responsible for what your processors do with your customers' data
- Keeping data "forever, just in case"
How Vegavaan can help
Compliance on paper is not enough; the website and app have to work differently. At Vegavaan Info Solutions, our web, app and security teams can help you:
- Audit your website, app and tools against the DPDP checklist
- Rebuild forms, consent checkboxes, consent records and preference centres
- Build a "Your data" request portal and automatic deletion jobs
- Harden security with encryption, access control, logging and VAPT security testing
- Prepare a practical breach response plan
Read also: Cybersecurity in 2026: How Indian Businesses Can Stay Safe from AI-Powered Attacks.
👉 Book a free DPDP readiness check for your website or app.
Frequently asked questions
When does the DPDP Act fully apply?
The DPDP Rules were notified on 13 November 2025. Consent Manager rules apply from 13 November 2026, and the main obligations for businesses, including notice, consent, security, breach reporting and user rights, apply from 13 May 2027.
Does DPDP apply to small businesses and startups?
Yes. There is no general exemption for small businesses. The government can exempt some classes of businesses, including startups, from certain provisions, but you should plan as if the rules apply to you.
Do I need a cookie banner under DPDP?
India has no separate cookie law. However, if cookies or pixels collect personal data for non-essential purposes such as marketing, DPDP consent rules apply, so a clear consent banner is the safest approach.
How quickly must a data breach be reported under DPDP?
You must inform affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach.
Do I need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India. Every other business must still publish the contact details of a person who can answer questions about personal data.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards, with other penalties of up to ₹200 crore, ₹150 crore and ₹50 crore depending on the breach.
Conclusion
13 May 2027 is about seven months away. The businesses that start now can fix their websites and apps calmly, step by step. The ones that wait will be rushing in April. Start with a data map this month, use the 14-point checklist, and follow the roadmap one month at a time.
Need help making your website or app DPDP-ready? Talk to a Vegavaan expert.
This article is for general information and is not legal advice. Please consult a qualified legal professional for advice on your specific situation. Sources: DPDP Act, 2023 and DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025), as summarised by Bar & Bench, AMLEGALS and ComplianceHub.
